13 ms·
Using close script tag In A JavaScript Literal
- deleted 17y ago[deleted]
- IgorPartola 17y agoI assume the author has no option to separate the JS code into a separate file, but that would certainly solve this problem.
- paraschopra 17y agoNo, as he wrote "<\/script>" works perfectly. Or even "</" + "script>" works.
- deleted 17y ago[deleted]
- IgorPartola 17y agoYes but if the string is dynamically generated your method will not be very effective. I think a better solution would be to use the CDATA tag.
- romland 17y agoSorry, deleted that comment before I saw your reply. As I read the whole article I realized that I had nothing interesting to add to it. :) And absolutely, CDATA is a solution for that scenario. For the curious, what I blurted out before reading the whole thing: HTML rules where the script is, of course it would also decide where it ends -- without having to parse the javascript. As for XSS, if you are vulnerable to this one, you are probably vulnerable to other nifty tricks as well. If you -really- need to use the /script tag, then most people know that the cheap hack is to just: alert("</scr"+"ipt>");
- pmjordan 17y agoBut surely the CDATA tag is vulnerable to the string "]]>" appearing embedded somewhere in the code?
- devinj 17y agoBest solution is just to put the javascript in another file. Barring that, escape your javascript. Replace < with <, etc. I am not sure CDATA exists in HTML (I seem to remember it being something for XML and DTDs).